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(U) Scope 

(U//FOUO) This Joint Intelligence Bulletin provides law enforcement and private sector 
safety officials with protective measures in light of the recent explosions that took place 
at the 2013 Boston Marathon in Boston, Massachusetts. The information is provided to 
support the activities of DHS and FBI and to assist federal, state, local, tribal, and 
territorial government counterterrorism and first responder officials and the private sector 
to deter, prevent, preempt, or respond to terrorist attacks in the United States. 
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Flomeland Security Act of 2002 (6 U.S.C. 482) and the Freedom of Information Act (5 U.S.C. 552). It is to be controlled, stored, handled, transmitted, distributed, 
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authorized need-to-know without appropriate prior authorization. State and local homeland security officials may share this document with authorized critical 
infrastructure and key resource personnel and private sector security officials without further approval from DHS. 

(U) Warning: This product may contain US person information that has been deemed necessary for the intended recipient to understand, assess, or act on the 
information provided. US person information is highlighted with the label USPER and should be protected in accordance with constitutional requirements and all 
federal and state privacy and civil liberties laws. 
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(U) Incident Details 

(U) On 15 April 2013, at approximately 2:45 pm, two explosions occurred in quick 
succession near the finish line of the Boston Marathon, killing at least three people and 
causing numerous injuries. 

(U) Ongoing Concerns with Terrorism in the Homeland 



(U//FOUO) The activities in Boston highlight the use of improvised explosive devices 
(lEDs) to target large gatherings, including at special events, in order to inflict mass 
casualties. Examples of previously attempted or plotted lED attacks include: 

— (U//FOUO) The undetonated lED discovered along the planned 201 1 “Martin 
Luther King Jr. Unity March” parade route in Spokane, Washington; 

— (U//FOUO) The November 2010 plot to detonate a vehicle-borne lED (VBIED) at 
an annual Christmas tree lighting ceremony in Portland, Oregon; 

— (U//FOUO) The October 201 0 plot to conduct multiple mass casualty bombings 
at MetroraiP®'’^’’ stations in Washington, DC; 

— (U//FOUO) The May 2010 attempted detonation of a vehicle-borne lED in Times 
Square; and 

— (U//FOUO) The September 2009 plot to attack the New York City subway using 
lEDs. 



(U//FOUO) Indicators of Pre-Operational Surveillance and Attack Planning 

(U//FOUO) Given these events, we are providing indicators and protective measures to 
aid law enforcement and first responders in identifying and mitigating potential threats. 
Each indicator listed below may be by itself, lawful conduct or behavior and may also 
constitute the exercise of rights guaranteed by the US Constitution. In addition, there 
may be a wholly innocent explanation for conduct or behavior that appears suspicious in 
nature. For this reason, no single indicator should be the sole basis for law enforcement 
action. The totality of behavioral indicators and other relevant circumstances should be 
evaluated when considering any law enforcement response or action. 

(U//FOUO) Possible indicators of pre-operational surveillance or attack planning 
include: 



— (U//FOUO) Unusual or prolonged interest in or attempts to gain sensitive 
information about security measures of personnel, entry points, peak days and 
hours of operation, and access controls such as alarms or locks; 

— (U//FOUO) Observation of security reaction drills or procedures; multiple false 
alarms or fictitious emergency calls to same locations or similar venues; 

— (U//FOUO) Discreet use of cameras or video recorders, sketching, or note-taking 
consistent with pre-operational surveillance; 
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— (U//FOUO) Interest in speaking with building maintenance personnel; 

— (U//FOUO) Observation of or questions about facility security measures, to 
include barriers, restricted areas, cameras, and intrusion detection systems; 

— (U//FOUO) Observations of or questions about facility air conditioning, heating, 
and ventilation systems; 

— (U//FOUO) Suspicious purchases of items that could be used to construct an 
explosive device, including hydrogen peroxide, acetone, gasoline, propane, or 
fertilizer; 

— (U//FOUO) Suspicious activities in storage facilities or other areas that could be 
used to construct an explosive device; and 

— (U//FOUO) Attempted or unauthorized access to rooftops or other potentially 
sensitive areas. 

(U) Protective Measures 

(U//FOUO) Terrorists have demonstrated continued interest in attacking significant 
infrastructure, economic, and symbolic targets. We encourage state and local law 
enforcement, as well as security personnel, to consider the following protective 
measures: 

— (U//FOUO) Establish a comprehensive security plan and emergency response 
plan for the event or facility that includes interaction and integration with local law 
enforcement and public safety agencies; 

— (U//FOUO) Test communications equipment with emergency responders, 
including primary and backup systems; 

— (U//FOUO) Provide VBIED indicators (e.g., vehicle sagging, illegally parked, 
etc.) and reporting procedures to facility or event staff; 

— (U//FOUO) Install vehicle barriers and designate vehicle marshaling locations to 
ensure adequate standoff distances from VBIEDs; 

— (U//FOUO) Establish personnel screening checkpoints for access control into the 
facility or event; 

— (U//FOUO) Conduct explosive detection canine team searches of vehicles 
requiring entrance into a secure zone; 

— (U//FOUO) Ensure personnel receive training on lED and threat awareness, 
emergency communication, response actions, and reporting of suspicious 
activity; 

— (U//FOUO) Develop mass evacuation procedures in response to a threat; 



UNCLASSIFIED//FOR OFFICIAL USE ONLY 

Page 3 of 4 



UNCLASSIFIED//FOR OFFICIAL USE ONLY 



— (U//FOUO) Identify and designate egress and ingress routes for emergency 
vehicles; 

— (U//FOUO) Institute strategies for detecting and reporting pre-operational 
surveillance and other suspicious activity; 

— (U//FOUO) Remove objects from the facility or event which could conceal lEDs 
(e.g., trash containers, crates, etc.); 

— (U//FOUO) Conduct additional sweeps of the facility or event area using roving 
patrols and explosive detection canine teams; 

— (U//FOUO) Implement a public awareness and vigilance campaign that provides 
information for reporting and responding to potential lED activity (e.g., PA system 
announcements, television ads, social media, etc.); and 

— (U//FOUO) Be vigilant of secondary devices; specifically at anticipated 
evacuation routes. 

(U//FOUO) We continue to urge federal, state, local, tribal, territorial, and private sector 
partners to remain alert, maintain vigilance, and report potential indications of 
pre-operational and suspicious activity. 



(U) Report Suspicious Activity 



(U) To report suspicious activity, law enforcement, Fire-EMS, private security personnel, and 
emergency managers should follow established protocols; all other personnel should call 911 or 
contact local law enforcement. Suspicious activity reports (SARs) wili be forwarded to the appropriate 
fusion center and FBI Joint Terrorism Task Force for further action. For more information on the 
Nationwide SAR initiative, visit http://nsi.ncirc.gov/resources.aspx. 



(U) Administrative Note: Law Enforcement Response 



(U//FOUO) Information contained in this inteliigence builetin is for officiai use only. No portion of this 
bulletin should be released to the media, the general public, or over nonsecure Internet servers. 

Release of this material could adversely affect or jeopardize investigative activities. 

(U) For comments or questions related to the content or dissemination of this document, please contact 
the FBI Counterterrorism Analysis Section at (202) 324-3000 or FBI CTAS@ic.fbi.gov or the l&A 
Production Branch by e-mail at lA.PIVKgthq.dhs.qov . 



(U) l&A would like to invite you to participate in a brief customer feedback survey regarding this product. 
Your feedback is extremely important to our efforts to improve the quality and impact of our products on your 
mission. Please click below to access the form and then follow a few simple steps to complete and submit 
your response. Thank you. 




urvey 



(U) Tracked by: HSEC-8.1 , HSEC-8.3, HSEC-8.10, MSEC 8.9 
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